CVE-2025-23166 | BDVDB-2026-279402 Detail

Description#

The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when executing in a background thread, crashing the Node.js process. Such cryptographic operations are commonly applied to untrusted inputs. Thus, this mechanism potentially allows an adversary to remotely crash a Node.js runtime.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12025-05-19Record published in the CVE List.
2. Version 22025-05-28Most recent update recorded in the CVE List.